NIST SP 800-210 General Access Control Guidance for Cloud Systems 5.2: Protect SaaS data confidentiality with encryption and attribute-based control without crippling performance

What does 5.2 require?

The integrity and confidentiality of sensitive data in the data owner's domain are protected, for example by encryption where decryption keys are disclosed only to authorised users, and attribute-based access control and attribute-based encryption can tie access to user attributes; given the data volumes of SaaS, the scheme is designed to keep confidentiality while preserving acceptable performance.